CVE-2024-26937

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/gt: Reset queue_priority_hint on parking

Originally, with strict in order execution, we could complete execution

only when the queue was empty. Preempt-to-busy allows replacement of an

active request that may complete before the preemption is processed by

HW. If that happens, the request is retired from the queue, but the

queue_priority_hint remains set, preventing direct submission until

after the next CS interrupt is processed.

This preempt-to-busy race can be triggered by the heartbeat, which will

also act as the power-management barrier and upon completion allow us to

idle the HW. We may process the completion of the heartbeat, and begin

parking the engine before the CS event that restores the

queue_priority_hint, causing us to fail the assertion that it is MIN.

<3>[ 166.210729] __engine_park:283 GEM_BUG_ON(engine->sched_engine->queue_priority_hint != (-((int)(~0U >> 1)) - 1))

<0>[ 166.210781] Dumpin

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References